You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
At least for the U2F / Webauthn function, I think most services are equally pwned whether the key is duplicated, or just used to authenticate once while under the control of the attacker.
Yeah, for U2F without a PIN protecting the key, it doesn't really matter much. I'll happily take an open key based on a jellybean micro for *just* U2F. Things get more interesting for PGP/SSH use with a PIN protecting the key material.
